In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix command flush on cable pull
System crash due to command failed to flush back to SCSI layer.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout
The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL.
Add a check to make sure commands are flush back on session tear down to prevent the null pointer access.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-modules-extraUpgrade perfUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade rvUpgrade libperfUpgrade kernel-rt-debug-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-cross-headersUpgrade kernel-64k-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-abi-stablelistsUpgrade kernel-64kUpgrade kernel-toolsUpgrade kernel-64k-debugUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-modulesUpgrade bpftoolUpgrade kernel-64k-debug-devel-matchedUpgrade kernelUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-develUpgrade kernel-coreUpgrade kernel-64k-debug-develUpgrade kernel-debugUpgrade kernel-docUpgrade kernel-zfcpdump-develUpgrade kernel-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debugUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-tools-libsUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernel-64k-modules-coreUpgrade rtlaUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-uki-virtUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-headers | Nov 4, 2024 | May 1, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-livepatch-5.10.215-203.850Upgrade perf-debuginfoUpgrade kernel-livepatch-4.14.345-262.561Upgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernelUpgrade python-perf-debuginfoUpgrade bpftoolUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade python-perf | Aug 14, 2024 | May 1, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Jul 16, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade bpftool | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade python3-perf | Oct 8, 2024 | May 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel | Jul 17, 2024 | May 1, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 16, 2024 | May 1, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 25, 2024 | May 1, 2024 |
| Suse | — | Upgrade kernel-syms-rtUpgrade kernel-azure-optionalUpgrade kernel-devel-azureUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-azureUpgrade dtb-freescaleUpgrade kernel-default-livepatchUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade kernel-source-azureUpgrade dtb-amlogicUpgrade kernel-azure-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-default-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-64kbUpgrade dtb-lgUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade dtb-qcomUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rtUpgrade kernel-syms-azureUpgrade dtb-rockchipUpgrade kernel-sourceUpgrade kernel-kvmsmallUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-apmUpgrade dtb-exynosUpgrade kernel-64kbUpgrade kernel-macrosUpgrade dtb-amazonUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade kernel-rt-vdsoUpgrade kernel-default-develUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade dtb-socionextUpgrade dtb-appleUpgrade kernel-default-optionalUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-renesasUpgrade dtb-marvellUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-azureUpgrade dtb-sprdUpgrade dtb-nvidiaUpgrade dtb-broadcomUpgrade cluster-md-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-debug-develUpgrade kernel-rt-optionalUpgrade kernel-obs-buildUpgrade kernel-64kb-develUpgrade dtb-allwinnerUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade dtb-hisiliconUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade dtb-caviumUpgrade dtb-alteraUpgrade dlm-kmp-rtUpgrade dtb-xilinxUpgrade kselftests-kmp-rtUpgrade dtb-mediatekUpgrade kernel-azure-baseUpgrade kernel-64kb-optionalUpgrade kernel-default-baseUpgrade dlm-kmp-defaultUpgrade kernel-source-rtUpgrade dtb-armUpgrade dtb-amdUpgrade kernel-docsUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-debugUpgrade kernel-azure-extraUpgrade kernel-rt_debug | May 15, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-awsUpgrade linux-image-bluefieldUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-oracleUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1068-azureUpgrade linux-image-kvmUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-5.4.0-1040-iotUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-virtualUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-189-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-azure-lts-20.04Upgrade linux-image-6.8.0-1006-oemUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-azure-fdeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-raspiUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-intel-iotgUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-20.04dUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-gkeop-5.4Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-gke-5.15Upgrade linux-image-intelUpgrade linux-image-genericUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-gkeopUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-20.04cUpgrade linux-image-nvidiaUpgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-oem-osp1Upgrade linux-image-gcpUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-oemUpgrade linux-image-raspi2Upgrade linux-image-6.8.0-1008-azureUpgrade linux-image-oem-24.04Upgrade linux-image-ibm-classic | Jul 1, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub